Security Mailing List... is there are any?

Vault
1

Hello,

Is there any security mailing list we can subscribe to receive information about releases, security incidents, etc.?

Kind regards

2

For Vault, or CVE in common?

https://cve.mitre.org/news/newsletter.html

There are news feeds, too

https://cve.mitre.org/cve/data_feeds.html

For releases and other news of HashiCorp I would suggest watching the blog

And the newsletter (at the bottom of the side)

1 Like
3

hello,

I’m already subscribed to the groups, blogs, etc. thank you, I’m looking for something dedicated only to hashicorp products, including CVE. Would be great to have some entry-level enterprise grade subscription, but there is none. An idea to extend the pricing model with such service?

4

Hi,

Our changelogs (here is Vault’s, for example) are the best place to see when we’ve made security fixes. Security notifications live in SECURITY sections in the changelog. There is an example of such a section in our 1.3.4 release.

When we do a release announcement, we also highlight security fixes if there are any in the release.

Hope this is helpful, although it sounds like it might not be exactly what you’re looking for.

2 Likes
5

Hi @avoidik,

I reached out to the HashiCorp security team, and they say this is something they’re working on as part of a bigger initiative. We’re very invested in making how we communicate about the security of our products as effective and efficient as possible, including being able to alert the correct audience of the correct things.

Can’t promise timelines however.

1 Like
6

thank you for your answers, @ncabatoff really curious to know what it could be :slight_smile: